Using Google Analytics without GDPR consent • Hacker News Board

Re: Using Google Analytics without GDPR consent

#11

Post by zepolen » Fri, Dec 04, 2020, 1:03 PM UTC

gchambert wrote: post #9

What is forbidden by GDPR isn't specifically cookie or IP, but but any tracking mechanism which allows to identify an individual uniquely with some amount of certainty, and without prior consent. What he is doing is illegal.

Doesn't that make access log files illegal?

Re: Using Google Analytics without GDPR consent

#12

Post by grabeh » Fri, Dec 04, 2020, 1:04 PM UTC

ThePhysicist wrote: post #8

Google recently introduced "Consent Mode" which basically disables cookie-based tracking and collects anonymous data only. I still find it problematic as Google probably doesn't need a cookie to identify you but it's at least something that is officially backed by Google, instead of a hack like this. BTW if you use client information to derive an identifier that is unique within a session and you send that identifier…

We do see a few references to cookies in the ePrivacy Directive but absolutely right to drive home the point that it's technology agnostic!

Re: Using Google Analytics without GDPR consent

#13

Post by krsdcbl » Fri, Dec 04, 2020, 1:05 PM UTC

Not a lawyer myself, but as far as my understanding goes you are identifying your user already by determining his ip, and all the transformations you do to create an id is still reversible with the fixed seeds in your script - so you'll end up sending data to google that makes the user idenfiable nonetheless, so i HIGHLY doubt this is a legitimate way around gpdr.

correct me if I'm making wrong assumptions here, as staid - not a lawyer either, just having lots to do with the topic as a EU based webdeveloper.

Re: Using Google Analytics without GDPR consent

#14

Post by dustinmoris » Fri, Dec 04, 2020, 1:05 PM UTC

Honestly, if you’re just a small personal website or blog then just don’t bother with those idiotic cookie consent banners. Use Google Analytics or whatever makes you happy and nobody will ever say anything to you unless you’re an extremely famous person and even then the chances of someone ever bothering you regarding a GA cookie is very unlikely. Especially if you’re a tech blog your readers know how cookies work and how to protect themselves from “tracking” so you’re not even doing anyone a favour. It’s pure annoyance with zero benefit. Obviously if you’re a big corp you’ll have to comply, but I’d even question then what the EU is really going to do. Just write a page of how you use data and be honest, transparent and ethical about it and spare yourself to bastardise your beautiful website with EU shenanigans. And I’m from the EU and even dislike it.

Re: Using Google Analytics without GDPR consent

#15

Post by simpss » Fri, Dec 04, 2020, 1:07 PM UTC

zepolen wrote: post #11

gchambert wrote: post #9

What is forbidden by GDPR isn't specifically cookie or IP, but but any tracking mechanism which allows to identify an individual uniquely with some amount of certainty, and without prior consent. What he is doing is illegal.

Doesn't that make access log files illegal?

log files have a different original purpose. But yes, if you repurpose your log files to track individual users granularly, that processing would be illegal without gathering informed consent first.

Re: Using Google Analytics without GDPR consent

#16

Post by jraph » Fri, Dec 04, 2020, 1:09 PM UTC

dustinmoris wrote: post #14

Honestly, if you’re just a small personal website or blog then just don’t bother with those idiotic cookie consent banners. Use Google Analytics or whatever makes you happy and nobody will ever say anything to you unless you’re an extremely famous person and even then the chances of someone ever bothering you regarding a GA cookie is very unlikely. Especially if you’re a tech blog your readers know how cookies work a…

Honestly, please respect the laws (unless you are doing civil disobedience, I won't judge you) and people even if they are techies.

You don't want to show me a banner because it's painful? Right, I agree. Just don't opt me in into this crap and then you don't need to show me the banner.

You can use your server logs to measure your audience.

Re: Using Google Analytics without GDPR consent

#17

Post by dvdkhlng » Fri, Dec 04, 2020, 1:10 PM UTC

dannyw wrote: post #4

jwalton wrote: post #2

> `/ip=([\d.]*)\n/` 1. This is going to break if your clients are using IPv6. 2. IP addresses are generally considered PII under GDPR[0], but IANAL and I don't know what that means as far as compliance. [0]( https://www.groundlabs.com/blog/what-is-pii-for-gdpr/ )

If you hash your IP with a bunch of other fairly unpredictable and high cardinality information; it's no longer PII.

They are are using a 53-bit hash cyrb53 [1] of the string "IP address + website domain + user agent + language + validity days". It looks feasible that many of the generated IDs could be retroactively brute-force mapped back to an IPv4 address with high confidence (small chance of error due to hash collisions).

[1] https://stackoverflow.com/questions/7616461/generate-a-hash-...

Re: Using Google Analytics without GDPR consent

#18

Post by krsdcbl » Fri, Dec 04, 2020, 1:10 PM UTC

dustinmoris wrote: post #14

Honestly, if you’re just a small personal website or blog then just don’t bother with those idiotic cookie consent banners. Use Google Analytics or whatever makes you happy and nobody will ever say anything to you unless you’re an extremely famous person and even then the chances of someone ever bothering you regarding a GA cookie is very unlikely. Especially if you’re a tech blog your readers know how cookies work a…

honestly this is terrible advice. I know it's annoying to many people, but the EU isn't autonomously pursuing corps big or small - its legislation will kick into action if _anyone_ files a complaint after visiting your website, and you'll be subject to the same possible penalties as anyone.

Re: Using Google Analytics without GDPR consent

#19

Post by yostrovs » Fri, Dec 04, 2020, 1:10 PM UTC

dustinmoris wrote: post #14

Honestly, if you’re just a small personal website or blog then just don’t bother with those idiotic cookie consent banners. Use Google Analytics or whatever makes you happy and nobody will ever say anything to you unless you’re an extremely famous person and even then the chances of someone ever bothering you regarding a GA cookie is very unlikely. Especially if you’re a tech blog your readers know how cookies work a…

You forgot to add that it's important to also ensure you don't have enemies in relevant govt positions before deciding on your cookie policy.

Re: Using Google Analytics without GDPR consent

#20

Post by yostrovs » Fri, Dec 04, 2020, 1:12 PM UTC

jraph wrote: post #16

dustinmoris wrote: post #14

Honestly, if you’re just a small personal website or blog then just don’t bother with those idiotic cookie consent banners. Use Google Analytics or whatever makes you happy and nobody will ever say anything to you unless you’re an extremely famous person and even then the chances of someone ever bothering you regarding a GA cookie is very unlikely. Especially if you’re a tech blog your readers know how cookies work a…

Honestly, please respect the laws (unless you are doing civil disobedience, I won't judge you) and people even if they are techies. You don't want to show me a banner because it's painful? Right, I agree. Just don't opt me in into this crap and then you don't need to show me the banner. You can use your server logs to measure your audience.

You want the warning banners simply because it's a law or do they actually help you with something? Out of curiosity, do you ever break driving laws such as speed limits?